loki-mode 9.18.2 → 9.19.1

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v9.18.2
+# Loki Mode v9.19.1
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v9.18.2 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v9.19.1 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-9.18.2
+9.19.1

package/autonomy/loki

@@ -684,7 +684,7 @@ loki_remote_submit() {
             last="$status"
         fi
         case "$status" in
-            fired|error|rejected*)
+            passed|failed|unknown|error|rejected*)
                 break
                 ;;
         esac
@@ -701,16 +701,22 @@ loki_remote_submit() {
         return 1
     fi
 
-    # ponytail: the server reports DISPATCH success ("fired" = the pod launched
-    # the build), not the build's own exit code -- run_loki_command returns true
-    # for a --detach launch and for the detach-timeout path. So a non-"fired"
-    # status is a real failure, but "fired" is not yet proof the build passed.
-    # Upgrade path: have trigger-server record the build's exit code and expose
-    # a terminal status here, then gate CI on that instead.
+    # Gate on the BUILD's outcome, not on "a build was launched". The server
+    # reports passed / failed / unknown as distinct terminal statuses (see
+    # JOB_TERMINAL_STATUSES in trigger-server.py). Anything that is not
+    # "passed" exits non-zero so a CI pipeline cannot go green on a failed
+    # build. "unknown" -- the build detached and its exit code was never
+    # observed -- fails CLOSED: an outcome nobody observed is not a pass.
     case "$status" in
-        fired) return 0 ;;
-        "")    echo -e "${RED}loki: job $job_id did not reach a terminal status${NC}" >&2; return 1 ;;
-        *)     echo -e "${RED}loki: remote job $job_id failed: $status${NC}" >&2; return 1 ;;
+        passed) return 0 ;;
+        unknown)
+            echo -e "${RED}loki: remote job $job_id outcome UNKNOWN${NC}" >&2
+            echo "  The build detached and its exit code was never observed." >&2
+            echo "  An unobserved outcome is not a pass; treating it as a failure." >&2
+            return 1
+            ;;
+        "")     echo -e "${RED}loki: job $job_id did not reach a terminal status${NC}" >&2; return 1 ;;
+        *)      echo -e "${RED}loki: remote job $job_id failed: $status${NC}" >&2; return 1 ;;
     esac
 }
 
@@ -832,6 +838,17 @@ loki_remote_verify_receipt() {
         return 1
     fi
 
+    # Drift is REPORTED, never a verdict. This receipt was produced in a cluster
+    # pod and is being checked against a different tree, so drift is the normal
+    # result and says nothing about tampering -- docs/VERIFICATION-COST.md:
+    # hash_ok is integrity, `ok` folds in tree_drift and false-alarms here.
+    # Stated rather than suppressed: silently dropping a true fact because it is
+    # inconvenient is the same error as folding UNCHECKED into UNSIGNED.
+    if [ "$(printf '%s' "$out" | jq -r '[.diff_drift,.tree_drift]|index(true)!=null' 2>/dev/null)" = "true" ]; then
+        echo "  Drift: this tree differs from the one the receipt records. Expected --"
+        echo "    the build ran elsewhere. Not tampering, and not part of the verdict."
+    fi
+
     # gpg_ok=false covers TWO facts that must never be conflated: the signature
     # is cryptographically bad over this content (the receipt was ALTERED), and
     # gpg could not evaluate it at all (we do not hold the public key). Only the
@@ -7950,12 +7967,23 @@ cmd_preview() {
 # build started, so it has NO running-app precondition. Folding it into preview
 # would force preview's running-app gate onto a feature that must not have one.
 #
-# HARD INVARIANT (DEPLOY-PLAN LOCK 5 + BRANCH-LIFECYCLE LOCK B4): PRINT-ONLY.
-# cmd_deploy NEVER runs a cloud CLI (vercel/netlify/flyctl/wrangler) -- not even
-# `--version` -- and NEVER runs `git push` or `gh pr create`. Tool detection is
-# `command -v` ONLY. Loki advises; the human runs the printed command. This keeps
-# the README promise ("Does not deploy -- human runs deploy commands") literally
-# true. Only the clipboard tools (pbcopy/wl-copy/...) and `command -v` may run.
+# HARD INVARIANT (DEPLOY-PLAN LOCK 5 + BRANCH-LIFECYCLE LOCK B4): PRINT-ONLY BY
+# DEFAULT. Without --execute, cmd_deploy NEVER runs a cloud CLI
+# (vercel/netlify/flyctl/wrangler) -- not even `--version`. Tool detection is
+# `command -v` ONLY. Loki advises; the human runs the printed command.
+#
+# --execute (added for receipt-gated deploy) is the ONLY path that runs a deploy
+# command, and it is gated on an Evidence Receipt that VERIFIES this exact tree
+# (see the RECEIPT-GATED EXECUTION block below). The invariants that survive
+# unconditionally, with or without --execute:
+#   - NEVER `git push`, NEVER `gh pr create`. Out of scope entirely.
+#   - NEVER a destructive cloud operation (delete/destroy/teardown/drop),
+#     refused even with a perfect receipt.
+#   - NEVER reads or forwards cloud credentials. The deploy command inherits the
+#     user's already-authenticated CLI session; Loki does not touch credential
+#     files or secret-bearing env vars.
+# Only the clipboard tools (pbcopy/wl-copy/...), `command -v`, and -- under
+# --execute alone -- the gated deploy command itself may run.
 #
 # This whole block is contiguous (helpers + cmd_deploy) so a test can extract it
 # by name anchor, mirroring tests/test-preview-public.sh.
@@ -8176,7 +8204,16 @@ $options
 EOF
 
     if [ "$printed" = true ]; then
-        echo "Loki does not deploy for you. Review, then run the command yourself."
+        # This sentence is TRUE only on the print-only path. Under --execute the
+        # very next thing that happens may be the deploy running, and printing
+        # "Loki does not deploy for you" immediately before Loki deploys is
+        # exactly the kind of false statement this feature exists to not make.
+        # _LOKI_DEPLOY_EXECUTING is set by cmd_deploy for this one decision.
+        if [ "${_LOKI_DEPLOY_EXECUTING:-false}" = true ]; then
+            echo "Reviewing this command against the evidence gate (--execute)."
+        else
+            echo "Loki does not deploy for you. Review, then run the command yourself."
+        fi
         if [ "$do_clip" = true ] && [ -n "$first_cmd" ]; then
             _deploy_copy_clipboard "$first_cmd"
         fi
@@ -8191,9 +8228,493 @@ EOF
     return 1
 }
 
-# cmd_deploy [--dir <path>] [--no-clip] [--help]
+# =============================================================================
+# RECEIPT-GATED EXECUTION (--execute). Everything below is INERT unless the user
+# passes --execute on THIS invocation; the default path stays print-only.
+#
+# The design idea: a deploy is an action a VERIFIED RECEIPT AUTHORIZES. Not
+# "let the agent run gcloud" -- the gate is the evidence artifact we already
+# ship, and it must hold on every one of four independent checks.
+#
+# FAIL CLOSED IS THE WHOLE CONTRACT. Every helper here answers "" or a REFUSE
+# reason when it cannot evaluate its check. An unevaluated gate is not a pass:
+# no receipt, no python3, no gpg, a non-repo dir and an unresolvable anchor all
+# REFUSE. That direction is deliberate -- a gate that cannot tell you whether
+# the tree was verified must not deploy it.
+# =============================================================================
+
+# _deploy_receipt_verdict <proof.json>
+# Echoes exactly one of VERIFIED | UNSIGNED | UNCHECKED | TAMPERED, the same four
+# verdicts loki_remote_verify_receipt reports (see its header at loki:756).
+# The vocabulary is REUSED, not reinvented, because a second set of words for
+# the same four states is how they get collapsed into two.
+#
+# Deliberately NOT loki_remote_verify_receipt itself: that function returns 0 for
+# UNSIGNED, which is right for its caller (submit) and wrong here (integrity is
+# not provenance). We read the same signed/hash_ok/gpg_ok triple and let the
+# CALLER decide which verdicts authorize.
+#
+# hash_ok is read, NOT the top-level `ok` and NOT the exit code: `ok` folds in
+# tree_drift, and proof-verify.py exits 1 on drift alone. Gating on either would
+# refuse every honest receipt whose tree moved -- the false-alarm direction
+# docs/VERIFICATION-COST.md documents. Anything unreadable is TAMPERED-or-worse,
+# so the fallback verdict is UNCHECKED (never a pass).
+_deploy_receipt_verdict() {
+    local pj="$1"
+    local verifier="${_LOKI_SCRIPT_DIR}/lib/proof-verify.py"
+
+    [ -f "$pj" ] || { printf '%s' "UNCHECKED"; return 0; }
+    if [ ! -f "$verifier" ] || ! command -v python3 >/dev/null 2>&1; then
+        printf '%s' "UNCHECKED"; return 0
+    fi
+
+    local out hash_ok gpg_ok signed=0
+    out="$(python3 "$verifier" "$pj" "${TARGET_DIR:-.}" 2>/dev/null || true)"
+
+    # "The verifier did not RUN" and "the verifier says the hash is bad" are
+    # different facts and must not collapse. If they do, a broken python3
+    # produces the verdict TAMPERED -- an accusation of forgery for a check that
+    # never executed. That is the same error the signed path is careful to avoid
+    # with NO_PUBKEY (see loki:852): it sends a user hunting a forgery that never
+    # happened, and trains them to shrug at a real TAMPERED. Unparseable output
+    # is UNCHECKED, which still REFUSES -- fail-closed, honestly labelled.
+    if [ -z "$out" ] || ! printf '%s' "$out" | python3 -c 'import json,sys;json.load(sys.stdin)' >/dev/null 2>&1; then
+        printf '%s' "UNCHECKED"; return 0
+    fi
+
+    hash_ok="$(printf '%s' "$out" | python3 -c 'import json,sys;print(str(json.load(sys.stdin).get("hash_ok",False)).lower())' 2>/dev/null || printf 'false')"
+    gpg_ok="$(printf '%s' "$out" | python3 -c 'import json,sys;print(str(json.load(sys.stdin).get("gpg_ok","n/a")).lower())' 2>/dev/null || printf 'n/a')"
+
+    # Whether the receipt CARRIES a signature is read from the receipt, never
+    # inferred from gpg_ok -- gpg_ok is "n/a" both for "no signature" and for
+    # "gpg missing here", and conflating those mislabels a signed receipt.
+    if python3 -c 'import json,sys;sys.exit(0 if (json.load(open(sys.argv[1])).get("verification") or {}).get("gpg_signature") else 1)' "$pj" 2>/dev/null; then
+        signed=1
+    fi
+
+    if [ "$hash_ok" != "true" ]; then printf '%s' "TAMPERED"; return 0; fi
+    if [ "$signed" -eq 0 ]; then printf '%s' "UNSIGNED"; return 0; fi
+    case "$gpg_ok" in
+        true)  printf '%s' "VERIFIED" ;;
+        # Signed but the signature does not verify: contents or signature were
+        # altered. A missing PUBLIC KEY is a different fact (uncheckable, not an
+        # accusation), so it reports UNCHECKED -- which refuses here anyway.
+        false) if command -v gpg >/dev/null 2>&1 && [ "$(loki_remote_gpg_status "$pj")" = "nopubkey" ]; then
+                   printf '%s' "UNCHECKED"
+               else
+                   printf '%s' "TAMPERED"
+               fi ;;
+        *)     printf '%s' "UNCHECKED" ;;
+    esac
+    return 0
+}
+
+# _deploy_anchor_ok <proof.json> <dir>
+# Echoes "" when the receipt anchors to the tree in front of us, else a REFUSE
+# reason. Two checks, and BOTH are load-bearing:
+#
+#   1. resolve_anchor (autonomy/lib/outcome_ledger.py:122) -- sha algebra proving
+#      base..head is reachable and produces exactly the receipt's file set.
+#   2. head_sha == live HEAD.
+#
+# Check 2 is NOT redundant, and this was MEASURED rather than assumed: on a
+# fixture where the tree advanced one commit past the receipt, resolve_anchor
+# still returned ("anchored", None) -- correctly, because it answers "can I
+# follow this receipt to measure outcomes", not "does this receipt describe the
+# tree I am about to ship". Without check 2 a receipt for an ANCESTOR commit
+# authorizes deploying code it never verified, which is the exact failure this
+# feature exists to prevent.
+_deploy_anchor_ok() {
+    local pj="$1" dir="${2:-.}"
+    command -v python3 >/dev/null 2>&1 || { printf '%s' "anchor could not be evaluated (python3 unavailable)"; return 0; }
+    git -C "$dir" rev-parse --git-dir >/dev/null 2>&1 || { printf '%s' "anchor could not be evaluated (not a git repository)"; return 0; }
+
+    local live_head
+    live_head="$(git -C "$dir" rev-parse HEAD 2>/dev/null || printf '')"
+    [ -n "$live_head" ] || { printf '%s' "anchor could not be evaluated (no HEAD commit)"; return 0; }
+
+    # _LOKI_SCRIPT_DIR is a plain shell var, so it is passed EXPLICITLY here --
+    # relying on it being exported would silently fall back to a bare "lib" path
+    # and report every receipt as unevaluable.
+    PJ="$pj" LIVE_HEAD="$live_head" LOKI_LIB="${_LOKI_SCRIPT_DIR}/lib" \
+        python3 - "$dir" <<'PYANCHOR' 2>/dev/null || printf '%s' "anchor could not be evaluated (anchor check failed to run)"
+import json, os, sys
+sys.dont_write_bytecode = True
+sys.path.insert(0, os.environ.get("LOKI_LIB", ""))
+try:
+    from outcome_ledger import resolve_anchor
+except Exception:
+    print("anchor could not be evaluated (outcome_ledger unavailable)", end="")
+    raise SystemExit(0)
+d = json.load(open(os.environ["PJ"]))
+git = (d.get("facts") or {}).get("git") or {}
+base, head = git.get("base_sha") or "", git.get("head_sha") or ""
+files = git.get("diff") or d.get("files_changed") or []
+if not isinstance(files, list):
+    files = []
+state, reason = resolve_anchor(base, head, files, sys.argv[1])
+if state != "anchored":
+    # TWO DIFFERENT FACTS, and collapsing them makes this gate unusable.
+    #
+    # Measured on this repository: 8 of 9 receipts carry NO facts.git.base_sha,
+    # which matches the "0 of 9 anchored" figure already published in
+    # docs/VERIFICATION-COST.md. Refusing both cases identically means the gate
+    # rejects ~89% of real receipts on anchoring alone -- and a gate that always
+    # refuses teaches users to reach for an override, which is worse than no
+    # gate at all.
+    #
+    #   UNANCHORED  no baseline was recorded. We can prove neither match nor
+    #               mismatch. Refuse by DEFAULT, but let the caller override
+    #               per invocation, and record that nothing was proven.
+    #   MISMATCH    a baseline WAS recorded and it does not resolve to this
+    #               tree. That is positive evidence of the wrong build, and no
+    #               override may bypass it.
+    #
+    # The override covers "unknown", never "known wrong". Emitting a machine
+    # readable prefix so the caller can tell the two apart without parsing prose.
+    #
+    # DISCRIMINATED ON THE REASON NAME, not on `not base`. MEASURED: the receipt
+    # this repo's gate actually selects carries base_sha=4b825dc6 (the empty
+    # tree), so `base` is TRUTHY and a `not base` test files it under MISMATCH --
+    # the one case blocking the repo would stay unoverridable. resolve_anchor
+    # returns base_sha_empty (line 135) BEFORE the greenfield check (line 137),
+    # so reaching greenfield_no_baseline proves base_sha was non-empty.
+    #
+    # Exactly two reasons mean "no baseline was recorded", and together they
+    # cover all 9 receipts here (8 base_sha_empty, 1 greenfield_no_baseline).
+    # Every OTHER reason keeps refusing, including with the flag set:
+    #   not_reachable_from_head, diff_range_mismatch -- positive evidence of a
+    #     DIFFERENT change. Mismatch by construction.
+    #   change_not_committed, sha_not_in_history, head_sha_empty, no_git -- the
+    #     check could not be evaluated, and this gate's stated doctrine is that
+    #     an unevaluable check is a refusal, not a pass.
+    if reason in ("base_sha_empty", "greenfield_no_baseline"):
+        print("UNANCHORED:receipt records no baseline (%s), so it cannot be tied "
+              "to this tree" % reason, end="")
+    else:
+        print("receipt does not anchor to this tree (%s)" % (reason or "unresolvable"), end="")
+elif head != os.environ["LIVE_HEAD"]:
+    # Anchored but STALE: the receipt verified an ancestor, not this tree.
+    print("receipt records a different commit (%s) than HEAD (%s)"
+          % (head[:12], os.environ["LIVE_HEAD"][:12]), end="")
+PYANCHOR
+    return 0
+}
+
+# _deploy_is_destructive <command>
+# Returns 0 (true) if the command names a destructive cloud operation. Refused
+# even under --execute with a perfect receipt: a receipt authorizes shipping the
+# verified tree, never tearing an environment down. Word-boundary matched so
+# "wrangler pages deploy dist" is not caught by "destroy" appearing in a path.
+_deploy_is_destructive() {
+    printf '%s' "${1:-}" | grep -Eqi '(^|[^[:alnum:]_-])(delete|destroy|teardown|down|drop|rm|remove|purge|prune|wipe|scale-down)([^[:alnum:]_-]|$)'
+}
+
+# _deploy_tree_clean <dir>
+# Echoes "" when the working tree is clean, else a REFUSE reason. A dirty tree
+# means the bytes about to ship are NOT the bytes that were verified, which is
+# precisely the failure the receipt gate exists to prevent. A non-repo is
+# UNEVALUABLE, not clean -- it lands in REFUSE with a named reason.
+_deploy_tree_clean() {
+    local dir="${1:-.}"
+    git -C "$dir" rev-parse --git-dir >/dev/null 2>&1 || { printf '%s' "working tree could not be evaluated (not a git repository)"; return 0; }
+    local st rc=0
+    st="$(git -C "$dir" status --porcelain 2>/dev/null)" || rc=$?
+    # A git that could not report is UNEVALUABLE, never "clean" and never
+    # "dirty": naming it dirty invents a specific finding out of a failed
+    # measurement, and the user would go looking for edits that do not exist.
+    [ "$rc" -eq 0 ] || { printf '%s' "working tree could not be evaluated (git status failed)"; return 0; }
+    [ -z "$st" ] || printf '%s' "working tree is dirty ($(printf '%s\n' "$st" | grep -c '') uncommitted change(s))"
+    return 0
+}
+
+# _deploy_latest_receipt <dir>
+# Echoes the newest .loki/proofs/<id>/proof.json path, or "" if none exists.
+# Newest-by-name: proof ids are timestamp-prefixed, so lexical order is
+# chronological. Absence is not an error here; the caller turns "" into the
+# named REFUSE reason "no receipt".
+_deploy_latest_receipt() {
+    local dir="${1:-.}"
+    local proofs="$dir/${LOKI_DIR:-.loki}/proofs"
+    # LOKI_DIR may already be absolute (it is elsewhere in this CLI); prefer it
+    # directly when it resolves, else fall back to the dir-relative form.
+    [ -d "${LOKI_DIR:-}/proofs" ] && proofs="${LOKI_DIR}/proofs"
+    [ -d "$proofs" ] || { printf '%s' ""; return 0; }
+    local newest=""
+    local d
+    for d in "$proofs"/*/; do
+        [ -f "$d/proof.json" ] || continue
+        newest="$d/proof.json"
+    done
+    printf '%s' "$newest"
+    return 0
+}
+
+# _deploy_record <dir> <command> <exit_code> <run_id> <anchor_sha>
+# Writes the executed deploy's own record. A deploy with no record of itself
+# defeats the entire premise of gating on evidence.
+#
+# NOT written into .loki/proofs/: a hand-written JSON there carries no integrity
+# hash, so `loki proof verify` would read it as a TAMPERED receipt -- a
+# self-inflicted false alarm. It lives in .loki/deploys/ where it cannot be
+# mistaken for a verifiable receipt.
+_deploy_record() {
+    local dir="${1:-.}" command="$2" rc="$3" run_id="$4" anchor="$5"
+    # WHICH of the three applied: anchored (the receipt was tied to this tree)
+    # or unanchored_overridden (it was not, and the operator said go anyway).
+    # "refused" needs no value: a refusal never reaches this function, so the
+    # existence of a record already means one of the two above.
+    local anchor_state="${6:-anchored}"
+    local ddir="$dir/.loki/deploys"
+    [ -d "${LOKI_DIR:-}" ] && ddir="${LOKI_DIR}/deploys"
+    mkdir -p "$ddir" 2>/dev/null || return 0
+    local f="$ddir/$(date -u +%Y%m%dT%H%M%SZ)-$$.json"
+    DR_CMD="$command" DR_RC="$rc" DR_RUN="$run_id" DR_ANCHOR="$anchor" DR_OUT="$f" \
+    DR_STATE="$anchor_state" \
+        python3 -c '
+import json, os, datetime
+state = os.environ.get("DR_STATE") or "anchored"
+json.dump({
+    "recorded_at": datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
+    "command": os.environ["DR_CMD"],
+    "exit_code": int(os.environ["DR_RC"]),
+    "authorizing_run_id": os.environ["DR_RUN"],
+    "anchor_sha": os.environ["DR_ANCHOR"],
+    "anchor_state": state,
+    # Spelled out so a reader months later does not have to know the vocabulary
+    # to judge how strong the authorization was.
+    "anchor_proven": state == "anchored",
+}, open(os.environ["DR_OUT"], "w"), indent=2)
+' 2>/dev/null || return 0
+    printf '%s' "$f"
+    return 0
+}
+
+# _deploy_first_installed_command <dir> <type>
+# Echoes the idiomatic deploy command for the FIRST installed CLI of this type,
+# or "" if none is installed. Same ordering and same canonical strings
+# _deploy_print_cloud_options prints, so --execute can never run a command that
+# differs from the one the advisory showed. `command -v` only; no CLI is run.
+_deploy_first_installed_command() {
+    local dir="${1:-.}" type="${2:-}"
+    local options provider cli command docs
+    options="$(_deploy_options_for_type "$type")"
+    while IFS='|' read -r provider cli command docs; do
+        [ -n "$cli" ] || continue
+        if command -v "$cli" >/dev/null 2>&1; then
+            printf '%s' "$command"
+            return 0
+        fi
+    done <<EOF
+$options
+EOF
+    printf '%s' ""
+    return 0
+}
+
+# _deploy_try_execute <dir> <type>
+# The ONLY place a deploy command is ever run. Evaluates the gate, and either
+# executes + records, or REFUSES naming every failed check. Returns the deploy
+# command's exit code on execution, 1 on refusal.
+#
+# Ordering matters: the advisory has ALREADY been printed by the caller, so a
+# refusal still leaves the user with exactly the output they get today.
+_deploy_try_execute() {
+    local dir="${1:-.}" type="${2:-}"
+
+    local command
+    command="$(_deploy_first_installed_command "$dir" "$type")"
+    if [ -z "$command" ]; then
+        echo "" >&2
+        echo -e "${RED}REFUSED: --execute found no installed deploy CLI for this ${type} project.${NC}" >&2
+        echo "  Nothing was run. Install one of the CLIs listed above and re-run." >&2
+        return 1
+    fi
+
+    local reasons
+    reasons="$(_deploy_gate "$dir" "$command")"
+
+    # Split the marker out BEFORE the emptiness test: it is a fact about how
+    # the gate passed, never a reason it failed. Left in, it would refuse every
+    # overridden deploy and print the marker as a reason.
+    local anchor_state="anchored"
+    case "$reasons" in
+        *"$_DEPLOY_ANCHOR_MARKER"*)
+            anchor_state="unanchored_overridden"
+            # Shell substitution, NOT `grep -v`: under `set -e` a grep that
+            # filters out every line exits 1 and aborts the deploy silently --
+            # measured, and it looked exactly like the gate refusing.
+            reasons="${reasons//$_DEPLOY_ANCHOR_MARKER/}"
+            # Drop the blank line the removal left WITHOUT joining the real
+            # reasons together: sed deletes empty lines only, so a refusal that
+            # also carries other reasons still prints them one per line.
+            reasons="$(printf '%s' "$reasons" | sed '/^[[:space:]]*$/d')"
+            ;;
+    esac
+
+    if [ -n "$reasons" ]; then
+        echo ""
+        echo -e "${RED}REFUSED: not deploying. The evidence gate did not pass.${NC}" >&2
+        echo "  Would have run: ${command}" >&2
+        echo "" >&2
+        # printf '%s\n', NOT '%s': command substitution strips the trailing
+        # newline, and `read` then DISCARDS a final unterminated line -- so a
+        # single-reason refusal printed no reasons at all. A refusal that names
+        # nothing is the one thing this gate must never do.
+        printf '%s\n' "$reasons" | while IFS= read -r r; do
+            [ -n "$r" ] && echo "  - ${r}" >&2
+        done
+        echo "" >&2
+        echo "  A check that could not be EVALUATED is a refusal, not a pass." >&2
+        echo "  Nothing was executed. The advisory command above is unchanged." >&2
+        return 1
+    fi
+
+    # Gate passed. Capture the authorizing receipt's identity for the record.
+    local pj run_id anchor
+    pj="$(_deploy_latest_receipt "$dir")"
+    run_id="$(python3 -c 'import json,sys;print(json.load(open(sys.argv[1])).get("run_id") or "")' "$pj" 2>/dev/null || printf '')"
+    anchor="$(git -C "$dir" rev-parse HEAD 2>/dev/null || printf '')"
+
+    echo ""
+    if [ "$anchor_state" = "unanchored_overridden" ]; then
+        # "VERIFIED this tree" would be FALSE here: the receipt's checks passed,
+        # but nothing tied it to the code about to ship. Saying so is the whole
+        # point of allowing the override rather than weakening the gate.
+        echo -e "${YELLOW}Evidence gate PASSED with the anchor UNPROVEN (--allow-unanchored).${NC}"
+        echo "  Receipt ${run_id:-unknown} passed its own checks, but records no baseline,"
+        echo "  so it was NOT tied to this tree (${anchor:0:12}). You authorized this."
+    else
+        echo -e "${GREEN}Evidence gate PASSED.${NC} Receipt ${run_id:-unknown} VERIFIED this tree (${anchor:0:12})."
+    fi
+    echo "Running: ${command}"
+    echo ""
+
+    # Run in the project dir. No credential env var is read, set, or forwarded:
+    # the command inherits the user's already-authenticated CLI session as-is.
+    #
+    # eval is used because the canonical commands carry their own flags
+    # ("vercel --prod", "netlify deploy --prod --dir=<out>") and must word-split.
+    # The string is NOT user input: it comes from the hardcoded
+    # _deploy_options_for_type table, and the only path here has already passed
+    # the destructive-operation check in _deploy_gate.
+    local rc=0
+    ( cd "$dir" && eval "$command" ) || rc=$?
+
+    local rec
+    rec="$(_deploy_record "$dir" "$command" "$rc" "${run_id:-unknown}" "${anchor:-unknown}" \
+        "$anchor_state")"
+    echo ""
+    if [ "$rc" -eq 0 ]; then
+        echo -e "${GREEN}Deploy command exited 0.${NC}"
+    else
+        echo -e "${RED}Deploy command exited ${rc}.${NC}" >&2
+    fi
+    if [ -n "$rec" ]; then
+        echo "Deploy record: ${rec}"
+    else
+        # The deploy ALREADY RAN. Failing to record it silently is the exact
+        # thing this feature exists to prevent -- an executed deploy with no
+        # evidence of itself -- so it is reported LOUDLY rather than swallowed.
+        # Not an error exit: the deploy's own exit code is the honest verdict on
+        # the deploy, and overriding it would misreport what happened.
+        echo -e "${RED}WARNING: the deploy ran but its record could NOT be written.${NC}" >&2
+        echo "  Command: ${command}" >&2
+        echo "  Authorizing receipt run_id: ${run_id:-unknown}; anchor: ${anchor:-unknown}" >&2
+        echo "  Record this yourself: a deploy with no record of itself is unevidenced." >&2
+    fi
+    return "$rc"
+}
+
+# Emitted by _deploy_gate (not a refusal reason) when the anchor was UNPROVEN
+# and the operator overrode it. The gate runs inside $( ), so this travels on
+# stdout; a global assigned in the subshell would not survive.
+_DEPLOY_ANCHOR_MARKER="__LOKI_ANCHOR_UNPROVEN__"
+
+# _deploy_gate <dir> <command>
+# THE GATE. Echoes "" when all four checks pass, else the REFUSE reason(s), one
+# per line. Every check is evaluated so a refusal names everything wrong at once
+# rather than making the user re-run to discover the next problem.
+# The opt-in (check 4) is the CALLER's --execute flag and is not re-checked here.
+_deploy_gate() {
+    local dir="${1:-.}" command="${2:-}"
+    local reasons=""
+
+    # Hard limit, checked FIRST: no receipt authorizes a destructive operation.
+    if _deploy_is_destructive "$command"; then
+        reasons="${reasons}destructive operation refused: no receipt authorizes delete/destroy/teardown/drop
+"
+    fi
+
+    # An UNFILLED <placeholder> is a command written for a HUMAN to complete,
+    # not one to run. Executing it is at best a shell syntax error and at worst
+    # an unintended redirection ("--dir=<build-output>" redirects stdin from a
+    # file named build-output). Guessing the value would be worse still: we
+    # would deploy a directory nobody chose.
+    case "$command" in
+        *"<"*">"*) reasons="${reasons}deploy command contains an unfilled placeholder -- run it yourself with the real value: ${command}
+" ;;
+    esac
+
+    local pj
+    pj="$(_deploy_latest_receipt "$dir")"
+    if [ -z "$pj" ]; then
+        reasons="${reasons}no Evidence Receipt found (nothing has verified this tree)
+"
+    else
+        local verdict
+        verdict="$(_deploy_receipt_verdict "$pj")"
+        case "$verdict" in
+            VERIFIED) : ;;
+            UNSIGNED)  reasons="${reasons}receipt is UNSIGNED: integrity holds but provenance is unproven (set LOKI_PROOF_GPG_KEY; docs/SIGNED-RECEIPTS.md)
+" ;;
+            UNCHECKED) reasons="${reasons}receipt is UNCHECKED: its signature could not be evaluated here, so nothing was proven
+" ;;
+            TAMPERED)  reasons="${reasons}receipt is TAMPERED: its integrity hash does not match its contents
+" ;;
+            *)         reasons="${reasons}receipt verdict could not be determined
+" ;;
+        esac
+        local anchor_reason
+        anchor_reason="$(_deploy_anchor_ok "$pj" "$dir")"
+        case "$anchor_reason" in
+            UNANCHORED:*)
+                # Nothing was PROVEN either way. Overridable per invocation, and
+                # only the UNANCHORED-prefixed line is dropped: discarding the
+                # whole anchor check (or skipping the call) would also swallow
+                # the stale-receipt refusal, silently turning this flag into
+                # "skip anchoring entirely".
+                if [ "${LOKI_DEPLOY_ALLOW_UNANCHORED:-false}" = "true" ]; then
+                    # Emitted on STDOUT as a non-reason marker, not stored in a
+                    # variable: _deploy_gate is called inside $( ), so a global
+                    # assigned here dies with the subshell. The caller strips
+                    # this line before treating what remains as refusal reasons.
+                    reasons="${reasons}${_DEPLOY_ANCHOR_MARKER}
+"
+                else
+                    reasons="${reasons}${anchor_reason#UNANCHORED:} (re-run with --allow-unanchored to deploy anyway; nothing about the tree will have been proven)
+"
+                fi
+                ;;
+            "") : ;;
+            *)  # Positive evidence of the wrong build. No flag bypasses this.
+                reasons="${reasons}${anchor_reason}
+" ;;
+        esac
+    fi
+
+    local dirty
+    dirty="$(_deploy_tree_clean "$dir")"
+    [ -n "$dirty" ] && reasons="${reasons}${dirty}
+"
+
+    printf '%s' "$reasons"
+    return 0
+}
+
+# cmd_deploy [--dir <path>] [--no-clip] [--execute] [--help]
 # Advisory orchestration: detect project type + CI/CD pipeline + installed cloud
-# CLIs, then PRINT the canonical deploy command(s). PRINT-ONLY (see block header).
+# CLIs, then PRINT the canonical deploy command(s). PRINT-ONLY BY DEFAULT.
 # Placed LAST in the contiguous deploy block (all helpers above it) so the SDET
 # can extract from the first helper def to the close of cmd_deploy and capture the
 # whole self-contained unit (mirrors test-preview-public.sh, where cmd_preview is
@@ -8201,31 +8722,90 @@ EOF
 cmd_deploy() {
     local dir="${TARGET_DIR:-.}"
     local do_clip=true
+    local do_execute=false
+    # `local` so an AMBIENT LOKI_DEPLOY_ALLOW_UNANCHORED=true in the environment
+    # cannot opt in: it is reset to false on every invocation and only the flag
+    # below sets it. Same rule --execute already follows -- no env var or config
+    # file alone weakens this gate.
+    local LOKI_DEPLOY_ALLOW_UNANCHORED=false
 
     # Arg parse (mirror cmd_preview: lenient on unknown args -> no behavior drift).
     while [ $# -gt 0 ]; do
         case "${1:-}" in
             --help|-h|help)
-                echo -e "${BOLD}Loki Mode -- advisory deploy command (print-only)${NC}"
+                echo -e "${BOLD}Loki Mode -- deploy command advisory (print-only by default)${NC}"
                 echo ""
-                echo "Usage: loki deploy [--dir <path>] [--no-clip]"
+                echo "Usage: loki deploy [--dir <path>] [--no-clip] [--execute]"
                 echo ""
                 echo "Detects your project type and your installed cloud CLI (and any"
                 echo "CI/CD pipeline), then PRINTS the exact deploy command for YOU to run."
-                echo "It is advisory only: it NEVER deploys, NEVER runs a cloud CLI (not"
-                echo "even --version), and NEVER runs 'git push'. Loki does not access your"
-                echo "cloud account. You run the printed command. Detection is read-only."
+                echo "By default this is print-only and advisory: it NEVER deploys and"
+                echo "NEVER runs a cloud CLI (not even --version). It NEVER runs"
+                echo "'git push' on ANY path. Detection is read-only. You run the"
+                echo "printed command."
                 echo ""
                 echo "If a CI/CD pipeline (GitHub Actions, GitLab CI, Jenkins, CircleCI,"
                 echo "Azure Pipelines, Bitbucket) is detected, the primary advice is the"
                 echo "git push + pull-request path, because your pipeline deploys on merge."
                 echo ""
+                echo -e "${BOLD}--execute: a deploy authorized by a verified receipt${NC}"
+                echo ""
+                echo "With --execute, Loki runs the detected deploy command ONLY when ALL"
+                echo "of these hold. Any one failing REFUSES, and the refusal names which:"
+                echo "  1. An Evidence Receipt exists for this tree and its integrity hash"
+                echo "     matches (hash_ok)."
+                echo "  2. Its verdict is VERIFIED. UNSIGNED, UNCHECKED and TAMPERED all"
+                echo "     refuse -- integrity is not provenance."
+                echo "  3. The receipt anchors to the commit being deployed. A receipt for"
+                echo "     a different commit does not authorize this deploy."
+                echo "     Two outcomes are distinguished here, and only one is overridable:"
+                echo "       UNANCHORED  the receipt records no baseline, so neither a match"
+                echo "                   nor a mismatch can be proven. Refuses by default;"
+                echo "                   --allow-unanchored proceeds and records that the"
+                echo "                   anchor was never proven."
+                echo "       MISMATCH    a baseline IS recorded and resolves to a different"
+                echo "                   tree. That is evidence of the wrong build, and"
+                echo "                   --allow-unanchored does NOT bypass it."
+                echo "  4. You passed --execute on THIS invocation. No env var or config"
+                echo "     file alone can opt in."
+                echo ""
+                echo "It FAILS CLOSED: if a check cannot be evaluated at all (no receipt,"
+                echo "gpg unavailable, anchor unresolvable, not a git repo), that is a"
+                echo "REFUSAL, not a pass. A refusal still prints the advisory command."
+                echo ""
+                echo "Hard limits, with or without --execute:"
+                echo "  - NEVER runs a destructive cloud operation (delete, destroy,"
+                echo "    teardown, drop). Refused even with a valid receipt."
+                echo "  - NEVER runs 'git push' and NEVER creates a PR. Out of scope."
+                echo "  - NEVER reads or forwards cloud credentials. The deploy command"
+                echo "    inherits your already-authenticated CLI session."
+                echo "  - REFUSES if the working tree is dirty: deploying something other"
+                echo "    than what was verified is the exact failure this prevents."
+                echo ""
+                echo "Every executed deploy writes its own record to .loki/deploys/:"
+                echo "the command, its exit code, the authorizing receipt's run_id, the"
+                echo "resolved anchor, and anchor_state -- so a reader can tell later"
+                echo "whether the anchor was proven or explicitly overridden."
+                echo ""
                 echo "Options:"
                 echo "  --dir <path>   Project directory to scan (default: current dir)"
                 echo "  --no-clip      Do not copy the idiomatic command to the clipboard"
+                echo "  --execute      Run the deploy command if the receipt gate passes"
+                echo "  --allow-unanchored"
+                echo "                 Proceed when the receipt records NO baseline (nothing"
+                echo "                 about this tree is proven). Never bypasses a recorded"
+                echo "                 mismatch. Per-invocation only; no env var opts in."
                 echo "  --help, -h     Show this help and exit"
                 return 0
                 ;;
+            --execute)
+                do_execute=true
+                ;;
+            --allow-unanchored)
+                # Per-invocation, like --execute: exported for the gate to read,
+                # never persisted and never settable by config alone.
+                LOKI_DEPLOY_ALLOW_UNANCHORED=true
+                ;;
             --dir)
                 # Guard against a missing OR flag-shaped value: an unguarded
                 # shift when --dir is the last arg underflows under set -e, and a
@@ -8246,6 +8826,10 @@ cmd_deploy() {
     # Resolve to '.' if the chosen dir does not exist (honest, no crash).
     [ -d "$dir" ] || dir="."
 
+    # Tells the advisory printer which closing sentence is TRUE for this run.
+    # Scoped to this invocation only.
+    local _LOKI_DEPLOY_EXECUTING="$do_execute"
+
     # Detect CI/CD pipeline FIRST (BRANCH-LIFECYCLE LOCK B3 precedence).
     local cicd=""
     cicd="$(_deploy_detect_cicd "$dir" || true)"
@@ -8310,6 +8894,21 @@ cmd_deploy() {
                 : # No installed cloud CLI; the pipeline path already advised. Fine.
             fi
         fi
+        # --execute applies to the CLOUD command only. git push / PR creation
+        # stay out of scope entirely, so on the pipeline path --execute never
+        # touches the primary (git) advice above -- it can only run the
+        # secondary cloud command, and only if the receipt gate passes.
+        if [ "$do_execute" = true ]; then
+            if [ -n "$type" ]; then
+                _deploy_try_execute "$dir" "$type"
+                return $?
+            fi
+            echo "" >&2
+            echo -e "${RED}REFUSED: --execute has nothing to run here.${NC}" >&2
+            echo "  No deployable project type detected, and Loki never runs 'git push'" >&2
+            echo "  or creates a PR. Run the git advice above yourself." >&2
+            return 1
+        fi
         return 0
     fi
 
@@ -8329,6 +8928,14 @@ cmd_deploy() {
     # honest install hint) when NO matching CLI is installed.
     local rc=0
     _deploy_print_cloud_options "$dir" "$type" "$do_clip" "true" || rc=$?
+
+    # Execute ONLY if the user opted in on THIS invocation and the advisory
+    # above found something to run. The advisory has already printed, so a
+    # refusal below still leaves the user with today's output.
+    if [ "$do_execute" = true ] && [ "$rc" -eq 0 ]; then
+        _deploy_try_execute "$dir" "$type"
+        return $?
+    fi
     return $rc
 }
 

package/autonomy/trigger-server.py

@@ -105,6 +105,19 @@ JOB_EVENT = "loki_job"
 # storm cannot grow memory without limit.
 DEFAULT_JOB_HISTORY = 1024
 
+# Terminal job statuses a remote client can gate on. "queued" and "running"
+# are deliberately absent: a client must be able to tell "not done yet" from
+# "done and failed", which a single non-passed value could not express.
+#
+# Only JOB_STATUS_PASSED means the build itself succeeded. JOB_STATUS_UNKNOWN
+# means the build detached past our wait window and its exit code was never
+# observed -- an unobserved outcome is NOT a pass, and the client exits
+# non-zero on it (fail closed).
+JOB_STATUS_PASSED = "passed"
+JOB_STATUS_FAILED = "failed"
+JOB_STATUS_UNKNOWN = "unknown"
+JOB_TERMINAL_STATUSES = (JOB_STATUS_PASSED, JOB_STATUS_FAILED, JOB_STATUS_UNKNOWN)
+
 # A run id names a directory under .loki/proofs/. run.sh mints it as
 # "run-<utc>-<pid>-<rand>" or "proof-<utc>-<pid>-<rand>"; this is the alphabet
 # those forms use. Applied to the pointer file's contents (never to a request
@@ -338,21 +351,30 @@ def _reap_child(proc):
         pass
 
 
-def run_loki_command(args, dry_run=False):
-    """Run a loki command synchronously and reap it; or print it if dry_run.
+# Outcome of a dispatch, as distinct from "did it launch".
+#
+# run_loki_command already distinguished all three of these and then threw two
+# of them away by returning a bool. Collapsing "exited 0" and "still detached"
+# into True is what made a remotely-submitted build that STARTS and then FAILS
+# report success: the client had no value to gate on. UNKNOWN is not a pass --
+# an outcome we could not observe must fail closed.
+# ponytail: the outcome IS the terminal job status, so they are the same three
+# strings rather than two enums plus a mapping table.
+OUTCOME_PASSED = JOB_STATUS_PASSED    # ran to completion and exited 0
+OUTCOME_FAILED = JOB_STATUS_FAILED    # launch failed, or exited non-zero
+OUTCOME_UNKNOWN = JOB_STATUS_UNKNOWN  # detached; exit code never observed
 
-    Returns True if the command was launched and exited 0 (or backgrounded
-    cleanly within the wait window), False if the launch failed or it exited
-    non-zero. The child is always waited on, so no zombies accumulate. stderr
-    is captured on failure so a broken dispatch is diagnosable.
 
-    This is invoked from worker threads, so blocking here does not block the
-    HTTP listener.
+def run_loki_outcome(args, dry_run=False):
+    """Run a loki command and report WHICH of the three outcomes occurred.
+
+    Returns one of OUTCOME_PASSED / OUTCOME_FAILED / OUTCOME_UNKNOWN. This is
+    the honest version of run_loki_command, which answers only "did it launch".
     """
     cmd = ["loki"] + args
     if dry_run:
         logging.info("[DRY-RUN] Would run: %s", " ".join(cmd))
-        return True
+        return OUTCOME_PASSED
     logging.info("Running: %s", " ".join(cmd))
     try:
         proc = subprocess.Popen(
@@ -362,18 +384,14 @@ def run_loki_command(args, dry_run=False):
         )
     except (FileNotFoundError, OSError) as e:
         logging.error("Failed to launch %s: %s", " ".join(cmd), e)
-        return False
+        return OUTCOME_FAILED
 
     try:
-        # Wait (and thereby reap) the child. A --detach launch returns quickly;
-        # this bound only guards against a wedged launch.
         _, stderr = proc.communicate(timeout=DISPATCH_WAIT_SECONDS)
     except subprocess.TimeoutExpired:
-        # The dispatch is still running past our wait window. We stop blocking
-        # the worker thread, but the child is NOT abandoned: a one-shot daemon
-        # reaper thread waits on it so it is always reaped (no zombie) while
-        # THIS process is alive, and the OS reparents it after we exit. This
-        # keeps the "always waited on, no zombies" guarantee honest.
+        # Detached past the wait window. The reaper collects the child, but we
+        # never see its exit code, so the outcome is genuinely UNKNOWN -- NOT a
+        # pass. Reporting success here is exactly the defect this replaces.
         logging.info(
             "Dispatch pid=%d still running after %ds; reaping in background",
             proc.pid,
@@ -385,11 +403,11 @@ def run_loki_command(args, dry_run=False):
             name="loki-trigger-reaper-%d" % proc.pid,
             daemon=True,
         ).start()
-        return True
+        return OUTCOME_UNKNOWN
 
     if proc.returncode == 0:
         logging.info("Dispatch pid=%d completed (exit 0)", proc.pid)
-        return True
+        return OUTCOME_PASSED
 
     stderr_text = ""
     if stderr:
@@ -400,7 +418,28 @@ def run_loki_command(args, dry_run=False):
         proc.returncode,
         stderr_text or "(no stderr)",
     )
-    return False
+    return OUTCOME_FAILED
+
+
+def run_loki_command(args, dry_run=False):
+    """Run a loki command synchronously and reap it; or print it if dry_run.
+
+    Returns True if the command was launched and exited 0 (or backgrounded
+    cleanly within the wait window), False if the launch failed or it exited
+    non-zero. The child is always waited on, so no zombies accumulate. stderr
+    is captured on failure so a broken dispatch is diagnosable.
+
+    This is invoked from worker threads, so blocking here does not block the
+    HTTP listener.
+
+    Kept as the bool view for the GitHub webhook handlers, which only care
+    whether a dispatch started. A caller that must know whether the BUILD
+    passed wants run_loki_outcome instead. Behaviour is unchanged: a detached
+    dispatch (UNKNOWN) still reads as True here, exactly as before.
+    """
+    return run_loki_outcome(args, dry_run=dry_run) in (
+        OUTCOME_PASSED, OUTCOME_UNKNOWN,
+    )
 
 
 def handle_issues_event(payload, dry_run=False):
@@ -496,9 +535,11 @@ def handle_job_event(payload, dry_run=False):
         return None, "rejected (invalid spec)"
     args = ["start", spec.strip(), "--detach"]
     summary = "job %s: %s" % (payload.get("job_id", "?"), spec.strip())
-    success = run_loki_command(args, dry_run=dry_run)
-    status = "fired" if success else "error"
-    if success:
+    # A remote submitter gates CI on this, so report the BUILD's outcome, not
+    # merely that a build was launched. "fired" (launched) and "passed" must
+    # never share a value.
+    status = run_loki_outcome(args, dry_run=dry_run)
+    if status != OUTCOME_FAILED:
         send_notification("Trigger fired: %s" % summary)
     return summary, status
 
@@ -732,7 +773,16 @@ class Dispatcher:
                 continue
             try:
                 event_type, payload = item
-                job_id = payload.get("job_id") if isinstance(payload, dict) else None
+                # Honour job_id ONLY for a remotely-submitted job. A GitHub
+                # payload carries no job_id of its own, so accepting one from
+                # any payload let a holder of the WEBHOOK HMAC write into the
+                # /jobs status store -- overwriting a real job's terminal
+                # status (e.g. "passed" -> "fired") and re-introducing the
+                # false-green. That is a webhook credential reaching a /jobs
+                # capability, which the separate-credential design forbids.
+                job_id = (payload.get("job_id")
+                          if event_type == JOB_EVENT and isinstance(payload, dict)
+                          else None)
                 if job_id:
                     self.record_job(job_id, "running")
                 # Counted for every dispatch, including webhook builds that

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.18.2"
+__version__ = "9.19.1"
 
 # Expose the control app for easy import
 try:

package/dashboard/server.py

@@ -206,6 +206,7 @@ _SENSITIVE_READ_PREFIXES = (
     "/api/projects",
     "/api/council",
     "/api/proofs",
+    "/api/phases",
     "/api/memory",
     "/api/learnings",
     "/api/learning",
@@ -12226,6 +12227,23 @@ def _proof_pr_url(run_dir: _Path) -> Optional[str]:
     return None
 
 
+@app.get("/api/phases", dependencies=[Depends(auth.require_scope("read"))])
+async def phase_timeline():
+    """Measured phase segments for the active run, from real phase_change events.
+
+    dashboard/api_phases.py had NO importer and NO consumer: a complete
+    phase-timeline module, tested and unreachable. This route is the wiring.
+
+    The envelope is returned VERBATIM. Reshaping it here would fork the honesty
+    contract the module carries -- an unmeasured start is None (never 0), an
+    unreadable log reads differently from an empty one, and `sampled` says the
+    history can be missing phases shorter than one poll interval. A second
+    format is a second place for those distinctions to die.
+    """
+    from . import api_phases
+    return api_phases.phase_history(str(_get_loki_dir()))
+
+
 @app.get("/api/proofs", dependencies=[Depends(auth.require_scope("read"))])
 async def list_proofs():
     """List proof-of-run artifacts for the active project's .loki/proofs/."""

package/dashboard/static/index.html

@@ -1294,6 +1294,17 @@
           <loki-spec-panel id="spec-panel"></loki-spec-panel>
         </div>
         <loki-overview id="overview"></loki-overview>
+        <!-- PIPELINE. dashboard/api_phases.py parsed real phase_change events
+             into measured segments and had NO importer in server.py and NO
+             consumer here: a user could see a build finish or not, never WHICH
+             PHASE it was in or where it was stuck. Lives on Overview because
+             this SPA has no Activity section (no data-section="activity"), and
+             Overview is the live-run home. Hidden until data arrives. -->
+        <div id="pipeline-panel" style="display:none;margin-bottom:24px;">
+          <h3 style="font-family: var(--loki-font-family, 'Inter', system-ui, -apple-system, sans-serif); font-size: 1.15rem; font-weight: 400; color: var(--loki-text-primary); margin-bottom: 12px;">Pipeline</h3>
+          <div id="pipeline-list"></div>
+          <div id="pipeline-note" style="font-size:11px;color:var(--loki-text-muted);margin-top:8px;"></div>
+        </div>
         <loki-rarv-timeline id="rarv-timeline"></loki-rarv-timeline>
         <loki-session-diff id="session-diff"></loki-session-diff>
         <div style="margin-top: 28px;">
@@ -16184,6 +16195,127 @@ document.addEventListener('DOMContentLoaded', function() {
         .catch(function () { /* leave hidden: no receipt surface is better than a wrong one */ });
     };
 
+    // PIPELINE. The measured phase timeline from /api/phases, which serves
+    // dashboard/api_phases.py's envelope verbatim.
+    //
+    // WHAT IS NOT HERE, DELIBERATELY: a "not started" row. The envelope only
+    // contains phases that HAVE started, and the runtime declares no canonical
+    // ordered phase list -- _advance_current_phase takes any string, and the
+    // envelope's own "sampled" flag says absence of a segment is not evidence
+    // the phase did not occur. Drawing a fixed pipeline and marking the missing
+    // rows "not started" would invent exactly the fiction api_phases.py was
+    // written to replace (the old timeline rotated a hardcoded four-phase list
+    // and gave each invented segment a Math.random() duration). The three
+    // states we CAN measure are rendered distinctly, which is what keeps a
+    // stalled build from reading as a healthy one:
+    //
+    //   ENDED    start and end both measured -- a real duration
+    //   RUNNING  ongoing, no recorded end; elapsed is anchored to the server's
+    //            checked_at, never to the client clock
+    //   FAILED   the phase the runtime itself named FAILED
+    //
+    // and a fourth the envelope reports separately: the leading phase, known to
+    // have run but with no emitted start, so its duration is "not measured".
+    //
+    // An unmeasured duration renders "not measured", NEVER 0. A measured zero
+    // (two events inside one second -- timestamps are second-granular) still
+    // renders as 0s, so the guard is on the ENDPOINTS being absent, never on
+    // the duration being falsy.
+    window.loadPhases = function () {
+      var panel = document.getElementById('pipeline-panel');
+      var list = document.getElementById('pipeline-list');
+      var note = document.getElementById('pipeline-note');
+      if (!panel || !list) return;
+      fetch('/api/phases', { headers: { 'Accept': 'application/json' } })
+        .then(function (r) { return r.ok ? r.json() : null; })
+        .then(function (d) {
+          if (!d) return;                      // endpoint absent: leave hidden
+          var rows = (d.segments || []).slice();
+          if (d.leading_phase) rows.unshift(d.leading_phase);
+          if (!rows.length) return;            // no phase history: say nothing
+          var html = '';
+          for (var i = 0; i < rows.length; i++) {
+            var x = rows[i] || {};
+            // ESCAPED, unlike the verdict in loadReceipts. That comes from a
+            // controlled set; a phase name does not -- api_phases.py passes
+            // names through verbatim and _advance_current_phase accepts ANY
+            // string, so the set is open and this is untrusted text going into
+            // innerHTML on a dashboard that can be bound remotely.
+            var raw = String(x.phase || 'UNKNOWN');
+            var _d = document.createElement('div');
+            _d.textContent = raw;
+            var phase = _d.innerHTML;
+            var failed = /^FAIL/i.test(raw);
+            // The end a RUNNING segment is measured against is the server's
+            // own checked_at. A client clock would drift against the log.
+            var end = x.end;
+            if (end === null || end === undefined) {
+              if (x.ongoing) end = d.checked_at;
+            }
+            // Gate on the endpoints, not on the duration: end - start === 0 is
+            // a real measurement (second-granular timestamps), and hiding it
+            // as "-" would be the same lie in the other direction.
+            var measured = (x.start !== null && x.start !== undefined
+                            && end !== null && end !== undefined);
+            var secs = measured ? Math.max(0, Math.round(end - x.start)) : null;
+            var dur = measured
+              ? (secs < 60 ? (secs + 's')
+                 : (Math.floor(secs / 60) + 'm ' + (secs % 60) + 's'))
+              : 'not measured';
+            var state, col;
+            if (failed) {
+              state = 'FAILED'; col = 'var(--loki-error)';
+            } else if (x.ongoing) {
+              state = 'RUNNING'; col = 'var(--loki-warning)';
+            } else if (x.start === null || x.start === undefined) {
+              // The leading phase: it ran, but its start was never emitted, so
+              // it has no coordinate on a time axis. Named, not drawn.
+              state = 'RAN (start not recorded)'; col = 'var(--loki-text-muted)';
+            } else {
+              state = 'ENDED'; col = 'var(--loki-text-muted)';
+            }
+            var iter = (x.iteration === null || x.iteration === undefined)
+              ? '-' : ('iter ' + x.iteration);
+            html += '<div style="display:flex;gap:12px;align-items:center;padding:6px 8px;'
+                 + 'border-bottom:1px solid var(--loki-border);font-size:12px;">'
+                 + '<span style="font-weight:600;min-width:130px;">' + phase + '</span>'
+                 + '<span style="color:' + col + ';min-width:170px;">' + state + '</span>'
+                 + '<span style="min-width:90px;">' + dur + '</span>'
+                 + '<span style="color:var(--loki-text-muted);">' + iter + '</span>'
+                 + '</div>';
+          }
+          list.innerHTML = html;
+          if (note) {
+            // The envelope's own caveats, surfaced. Sampled data presented as
+            // complete is a claim the module explicitly refuses to make.
+            var parts = [];
+            // The VIEW's own age, not just the data's. A one-shot fetch of a
+            // LIVE pipeline freezes: "TESTING RUNNING 1m 40s" would sit there
+            // unchanged an hour later, which is the stalled-build-reads-as-
+            // healthy shape arriving through the view instead of the data.
+            // Polled below, and stamped here so a frozen row is self-labelling
+            // even if the poll dies.
+            if (d.checked_at) {
+              parts.push('Measured as of '
+                + new Date(d.checked_at * 1000).toISOString().slice(11, 19) + 'Z.');
+            }
+            if (d.sampled) {
+              parts.push('Sampled: the phase recorder polls, so a phase shorter '
+                + 'than one poll interval left no event and is absent here.');
+            }
+            if (d.freshness_s === null || d.freshness_s === undefined) {
+              parts.push('Age of this data: not measured.');
+            } else if (d.freshness_s > 120) {
+              parts.push('STALE: the phase log was last written '
+                + Math.floor(d.freshness_s / 60) + 'm ago.');
+            }
+            note.textContent = parts.join(' ');
+          }
+          panel.style.display = 'block';
+        })
+        .catch(function () { /* leave hidden: no pipeline is better than a wrong one */ });
+    };
+
     function poll() {
       fetch('/api/proofs/summary', { headers: { 'Accept': 'application/json' } })
         .then(function (r) { return r.ok ? r.json() : null; })
@@ -16228,6 +16360,18 @@ document.addEventListener('DOMContentLoaded', function() {
     // document and cannot see the SPA's manual data-loki-theme toggle, so we
     // pass the resolved theme as a query param (?theme=dark|light); the
     // standalone page reads it and matches. v7.18.0.
+    // The pipeline is a LIVE view, so unlike loadReceipts (a history view where
+    // one-shot is correct) it polls. Guarded on the Overview page being the
+    // visible one so a user sitting on another section spends no requests.
+    if (sectionId === 'overview') {
+      loadPhases();
+      if (!window._lokiPhasePoll) {
+        window._lokiPhasePoll = setInterval(function () {
+          var pg = document.getElementById('page-overview');
+          if (pg && pg.classList.contains('active')) loadPhases();
+        }, 15000);
+      }
+    }
     if (sectionId === 'insights') { loadLearnings(); }
     if (sectionId === 'cost') { loadBudget(); }
     if (sectionId === 'trust') {

package/docs/COMPETITIVE-SCORECARD.md

@@ -397,6 +397,51 @@ bash tests/test-competitor-verify-surface.sh               # the installed-CLI a
 loki proof verify <id>                                     # re-hash a receipt, exit 1 on tamper
 ```
 
+### 3c. Deploy surface, measured 2026-08-08
+
+Ran on the four competitor CLIs installed on this machine. Method matters here:
+a `--help` grep is NOT sufficient -- an earlier audit in this repo counted
+aider's `--verify-ssl` as a verification capability, which it is not. So each
+CLI was invoked as `<cli> deploy --help` and the result classified as a real
+subcommand only when it exited 0 AND its output named the subcommand, rather
+than falling through to generic help.
+
+| CLI | `deploy` subcommand |
+|---|---|
+| claude | none `[measured]` |
+| aider | none `[measured]` |
+| opencode | none `[measured]` |
+| codex | none `[measured]` |
+| loki | present, and evidence-gated `[measured]` |
+
+**4 of 4 installed competitor CLIs expose no deploy verb.** Loki's is gated on a
+verified receipt: it refuses on UNSIGNED, TAMPERED, anchor mismatch, or a dirty
+tree, and writes a receipt for the deploy itself naming the authorizing run_id.
+
+Scope limits, same as everywhere else in this file. This covers CLIs INSTALLED
+HERE. Factory, Devin, Replit and 8090 have no runnable binary on this machine
+(`bash benchmarks/head-to-head-readiness.sh` reports 3 ready / 4 blocked), so no
+claim is made about them. A hosted product may deploy without exposing a CLI
+verb -- Replit Agent's documented headline capability is exactly that. This
+measures a CLI surface, not a product capability, and it is not a quality
+comparison.
+
+Reproduce:
+
+```bash
+# Exit code ALONE is not the test: every CLI here exits 0 on `deploy --help`
+# because an unknown subcommand falls through to generic help. The first
+# version of this recipe did exactly that and reported all four as having a
+# deploy command. The output must NAME the subcommand.
+for c in claude aider opencode codex loki; do
+  out="$($c deploy --help 2>&1 | head -3)"
+  printf '%s' "$out" | grep -qiE "$c deploy|deploy -" \
+    && echo "$c: real deploy subcommand" \
+    || echo "$c: no deploy subcommand (fell through to generic help)"
+done
+bash autonomy/loki deploy --execute       # refuses, naming each failed check
+```
+
 ## 4. What we do NOT know
 
 This section is mandatory and is not empty.

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var p_=Object.create;var{getPrototypeOf:d_,defineProperty:eK,getOwnPropertyNames:c_}=Object;var l_=Object.prototype.hasOwnProperty;function i_(Z){return this[Z]}var a_,s_,n_=(Z,X,Q)=>{var Y=Z!=null&&typeof Z==="object";if(Y){var J=X?a_??=new WeakMap:s_??=new WeakMap,z=J.get(Z);if(z)return z}Q=Z!=null?p_(d_(Z)):{};let K=X||!Z||!Z.__esModule?eK(Q,"default",{value:Z,enumerable:!0}):Q;for(let $ of c_(Z))if(!l_.call(K,$))eK(K,$,{get:i_.bind(Z,$),enumerable:!0});if(Y)J.set(Z,K);return K};var HQ=(Z,X)=>()=>(X||Z((X={exports:{}}).exports,X),X.exports);var o_=(Z)=>Z;function r_(Z,X){this[Z]=o_.bind(null,X)}var l0=(Z,X)=>{for(var Q in X)eK(Z,Q,{get:X[Q],enumerable:!0,configurable:!0,set:r_.bind(X,Q)})};var p=(Z,X)=>()=>(Z&&(X=Z(Z=0)),X);var t0=import.meta.require;var xO={};l0(xO,{lokiDir:()=>j0,homeLokiDir:()=>R4,findRepoRootForVersion:()=>X$,REPO_ROOT:()=>i0});import{resolve as n7,dirname as Z$}from"path";import{fileURLToPath as t_}from"url";import{existsSync as UQ}from"fs";import{homedir as e_}from"os";function Zf(){let Z=kO;for(let X=0;X<6;X++){if(UQ(n7(Z,"VERSION"))&&UQ(n7(Z,"autonomy/run.sh")))return Z;let Q=Z$(Z);if(Q===Z)break;Z=Q}return n7(kO,"..","..","..")}function X$(Z){let X=Z;for(let Q=0;Q<6;Q++){if(UQ(n7(X,"VERSION"))&&UQ(n7(X,"autonomy/run.sh")))return X;let Y=Z$(X);if(Y===X)break;X=Y}return n7(Z,"..","..","..")}function j0(){return process.env.LOKI_DIR??n7(process.cwd(),".loki")}function R4(){return n7(e_(),".loki")}var kO,i0;var H8=p(()=>{kO=Z$(t_(import.meta.url));i0=Zf()});import{readFileSync as Xf}from"fs";import{resolve as Qf,dirname as Yf}from"path";import{fileURLToPath as Jf}from"url";function h3(){if(h5!==null)return h5;let Z="9.18.2";if(typeof Z==="string"&&Z.length>0)return h5=Z,h5;try{let X=Yf(Jf(import.meta.url)),Q=X$(X);h5=Xf(Qf(Q,"VERSION"),"utf-8").trim()}catch{h5="unknown"}return h5}var h5=null;var BQ=p(()=>{H8()});var _O={};l0(_O,{runOrThrow:()=>Tf,run:()=>E0,readStreamCapped:()=>NQ,commandVersion:()=>Cf,commandExists:()=>X9,ShellError:()=>Q$,MAX_STDOUT_BYTES:()=>bO});async function NQ(Z,X=bO){let Q=Z.getReader(),Y=new TextDecoder,J="",z=0;try{while(z<X){let{done:K,value:$}=await Q.read();if(K)break;if(!$)continue;if(z+=$.byteLength,z>X){let V=$.byteLength-(z-X);J+=Y.decode($.subarray(0,V),{stream:!0});break}J+=Y.decode($,{stream:!0})}J+=Y.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return J}async function E0(Z,X={}){let Q=Bun.spawn({cmd:[...Z],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),Y,J;if(X.timeoutMs&&X.timeoutMs>0)Y=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}J=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[z,K,$]=await Promise.all([NQ(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:z,stderr:K,exitCode:$}}finally{if(Y)clearTimeout(Y);if(J)clearTimeout(J)}}async function Tf(Z,X={}){let Q=await E0(Z,X);if(Q.exitCode!==0)throw new Q$(`command failed (${Q.exitCode}): ${Z.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function X9(Z){let X=wf(Z),Q=await E0(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function wf(Z){if(!/^[A-Za-z0-9._/-]+$/.test(Z))throw Error(`refused to shell-escape suspect token: ${Z}`);return Z}async function Cf(Z,X="--version"){if(!await X9(Z))return null;let Y=await E0([Z,X],{timeoutMs:5000});if(Y.exitCode!==0)return null;return((Y.stdout||Y.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var bO=16777216,Q$;var x9=p(()=>{Q$=class Q$ extends Error{message;exitCode;stdout;stderr;constructor(Z,X,Q,Y){super(Z);this.message=Z;this.exitCode=X;this.stdout=Q;this.stderr=Y;this.name="ShellError"}}});function o7(Z){return Ff?"":Z}var Ff,A0,F8,_0,$W0,a0,V8,Q9,h;var S6=p(()=>{Ff=(process.env.NO_COLOR??"").length>0;A0=o7("\x1B[0;31m"),F8=o7("\x1B[0;32m"),_0=o7("\x1B[1;33m"),$W0=o7("\x1B[0;34m"),a0=o7("\x1B[0;36m"),V8=o7("\x1B[1m"),Q9=o7("\x1B[2m"),h=o7("\x1B[0m")});import{existsSync as ff}from"fs";async function E7(){if(x4!==void 0)return x4;let Z="/opt/homebrew/bin/python3.12";if(ff(Z))return x4=Z,Z;let X=await X9("python3.12");if(X)return x4=X,X;let Q=await X9("python3");return x4=Q,Q}async function Y7(Z,X={}){let Q=await E7();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return E0([Q,"-c",Z],X)}var x4;var r7=p(()=>{x9()});var XA={};l0(XA,{runStatus:()=>Vh});import{existsSync as Y9,readFileSync as g3,readdirSync as aO,statSync as sO}from"fs";import{resolve as h8,basename as ef}from"path";import{homedir as Zh}from"os";function nO(Z){let X=Math.trunc(Z);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function oO(Z,X,Q){if(X===0)return null;let Y=Math.trunc(Z*100/X),J=Math.trunc(Z*AQ/X);if(J>AQ)J=AQ;let z=AQ-J,K=F8;if(Y>=80)K=A0;else if(Y>=50)K=_0;let $="=".repeat(Math.max(0,J))+" ".repeat(Math.max(0,z)),V=nO(Z),W=nO(X);return`  ${V8}${Q}${h} ${K}[${$}]${h} ${Y}% (${V} / ${W})`}async function Qh(){if(await X9("jq"))return!0;return process.stdout.write(`${A0}Error: jq is required but not installed.${h}
+var p_=Object.create;var{getPrototypeOf:d_,defineProperty:eK,getOwnPropertyNames:c_}=Object;var l_=Object.prototype.hasOwnProperty;function i_(Z){return this[Z]}var a_,s_,n_=(Z,X,Q)=>{var Y=Z!=null&&typeof Z==="object";if(Y){var J=X?a_??=new WeakMap:s_??=new WeakMap,z=J.get(Z);if(z)return z}Q=Z!=null?p_(d_(Z)):{};let K=X||!Z||!Z.__esModule?eK(Q,"default",{value:Z,enumerable:!0}):Q;for(let $ of c_(Z))if(!l_.call(K,$))eK(K,$,{get:i_.bind(Z,$),enumerable:!0});if(Y)J.set(Z,K);return K};var HQ=(Z,X)=>()=>(X||Z((X={exports:{}}).exports,X),X.exports);var o_=(Z)=>Z;function r_(Z,X){this[Z]=o_.bind(null,X)}var l0=(Z,X)=>{for(var Q in X)eK(Z,Q,{get:X[Q],enumerable:!0,configurable:!0,set:r_.bind(X,Q)})};var p=(Z,X)=>()=>(Z&&(X=Z(Z=0)),X);var t0=import.meta.require;var xO={};l0(xO,{lokiDir:()=>j0,homeLokiDir:()=>R4,findRepoRootForVersion:()=>X$,REPO_ROOT:()=>i0});import{resolve as n7,dirname as Z$}from"path";import{fileURLToPath as t_}from"url";import{existsSync as UQ}from"fs";import{homedir as e_}from"os";function Zf(){let Z=kO;for(let X=0;X<6;X++){if(UQ(n7(Z,"VERSION"))&&UQ(n7(Z,"autonomy/run.sh")))return Z;let Q=Z$(Z);if(Q===Z)break;Z=Q}return n7(kO,"..","..","..")}function X$(Z){let X=Z;for(let Q=0;Q<6;Q++){if(UQ(n7(X,"VERSION"))&&UQ(n7(X,"autonomy/run.sh")))return X;let Y=Z$(X);if(Y===X)break;X=Y}return n7(Z,"..","..","..")}function j0(){return process.env.LOKI_DIR??n7(process.cwd(),".loki")}function R4(){return n7(e_(),".loki")}var kO,i0;var H8=p(()=>{kO=Z$(t_(import.meta.url));i0=Zf()});import{readFileSync as Xf}from"fs";import{resolve as Qf,dirname as Yf}from"path";import{fileURLToPath as Jf}from"url";function h3(){if(h5!==null)return h5;let Z="9.19.1";if(typeof Z==="string"&&Z.length>0)return h5=Z,h5;try{let X=Yf(Jf(import.meta.url)),Q=X$(X);h5=Xf(Qf(Q,"VERSION"),"utf-8").trim()}catch{h5="unknown"}return h5}var h5=null;var BQ=p(()=>{H8()});var _O={};l0(_O,{runOrThrow:()=>Tf,run:()=>E0,readStreamCapped:()=>NQ,commandVersion:()=>Cf,commandExists:()=>X9,ShellError:()=>Q$,MAX_STDOUT_BYTES:()=>bO});async function NQ(Z,X=bO){let Q=Z.getReader(),Y=new TextDecoder,J="",z=0;try{while(z<X){let{done:K,value:$}=await Q.read();if(K)break;if(!$)continue;if(z+=$.byteLength,z>X){let V=$.byteLength-(z-X);J+=Y.decode($.subarray(0,V),{stream:!0});break}J+=Y.decode($,{stream:!0})}J+=Y.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return J}async function E0(Z,X={}){let Q=Bun.spawn({cmd:[...Z],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),Y,J;if(X.timeoutMs&&X.timeoutMs>0)Y=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}J=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[z,K,$]=await Promise.all([NQ(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:z,stderr:K,exitCode:$}}finally{if(Y)clearTimeout(Y);if(J)clearTimeout(J)}}async function Tf(Z,X={}){let Q=await E0(Z,X);if(Q.exitCode!==0)throw new Q$(`command failed (${Q.exitCode}): ${Z.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function X9(Z){let X=wf(Z),Q=await E0(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function wf(Z){if(!/^[A-Za-z0-9._/-]+$/.test(Z))throw Error(`refused to shell-escape suspect token: ${Z}`);return Z}async function Cf(Z,X="--version"){if(!await X9(Z))return null;let Y=await E0([Z,X],{timeoutMs:5000});if(Y.exitCode!==0)return null;return((Y.stdout||Y.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var bO=16777216,Q$;var x9=p(()=>{Q$=class Q$ extends Error{message;exitCode;stdout;stderr;constructor(Z,X,Q,Y){super(Z);this.message=Z;this.exitCode=X;this.stdout=Q;this.stderr=Y;this.name="ShellError"}}});function o7(Z){return Ff?"":Z}var Ff,A0,F8,_0,$W0,a0,V8,Q9,h;var S6=p(()=>{Ff=(process.env.NO_COLOR??"").length>0;A0=o7("\x1B[0;31m"),F8=o7("\x1B[0;32m"),_0=o7("\x1B[1;33m"),$W0=o7("\x1B[0;34m"),a0=o7("\x1B[0;36m"),V8=o7("\x1B[1m"),Q9=o7("\x1B[2m"),h=o7("\x1B[0m")});import{existsSync as ff}from"fs";async function E7(){if(x4!==void 0)return x4;let Z="/opt/homebrew/bin/python3.12";if(ff(Z))return x4=Z,Z;let X=await X9("python3.12");if(X)return x4=X,X;let Q=await X9("python3");return x4=Q,Q}async function Y7(Z,X={}){let Q=await E7();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return E0([Q,"-c",Z],X)}var x4;var r7=p(()=>{x9()});var XA={};l0(XA,{runStatus:()=>Vh});import{existsSync as Y9,readFileSync as g3,readdirSync as aO,statSync as sO}from"fs";import{resolve as h8,basename as ef}from"path";import{homedir as Zh}from"os";function nO(Z){let X=Math.trunc(Z);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function oO(Z,X,Q){if(X===0)return null;let Y=Math.trunc(Z*100/X),J=Math.trunc(Z*AQ/X);if(J>AQ)J=AQ;let z=AQ-J,K=F8;if(Y>=80)K=A0;else if(Y>=50)K=_0;let $="=".repeat(Math.max(0,J))+" ".repeat(Math.max(0,z)),V=nO(Z),W=nO(X);return`  ${V8}${Q}${h} ${K}[${$}]${h} ${Y}% (${V} / ${W})`}async function Qh(){if(await X9("jq"))return!0;return process.stdout.write(`${A0}Error: jq is required but not installed.${h}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -1236,4 +1236,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}case"start":{let{runStart:Y}=await Promise.resolve().then(() => (g_(),v_));return Y(Q)}default:return process.stderr.write(`Unknown command: ${X}
 `),process.stderr.write(m_),2}}lO();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var dV0=await pV0(Bun.argv.slice(2));process.exit(dV0);
 
-//# debugId=B34A84808461BB0C64756E2164756E21
+//# debugId=78ABA7C02A59114D64756E2164756E21

package/mcp/__init__.py

@@ -75,4 +75,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '9.18.2'
+__version__ = '9.19.1'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "9.18.2",
+  "version": "9.19.1",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "9.18.2",
+  "version": "9.19.1",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",